Elasticsearch ILM go straight from hot to delete

[Lumotheninja (Lumo)]

Can I skip the warm and cold phases and go straight from hot to delete? I am having some metricbeats/filebeats/logstash indices on dev environment with ILM configured for hot and delete phase, but for some reason they always go to completed phase without ever reaching delete

Using ES 7.2. btw

[dakrone (Lee Hinman)]

Hi Lumo,

Yes, you can go directly from hot to delete, what does your policy look like? When you say that your indices went into the completed phase, are these for indices that were created prior to the policy being changed to add a delete phase?

[Lumotheninja (Lumo)]

Hello Dakrone,

Sorry for the late reply. My policy looks like this:

logstash-policy: {

* version: 9,

* modified_date: "2020-05-27T05:50:02.316Z",

* policy: {
  * phases: {
    * hot: {
      * min_age: "0ms",

      * actions: {
        * rollover: {
          * max_size: "1mb",

          * max_age: "1h",

          * max_docs: 1}}},

    * delete: {
      * min_age: "1d",

      * actions: {
        * delete: { }}}}}

},

I left it for 1 day yesterday, after unlinking the policy and linking it back again to the latest index, it works! The remaining old index seems to be still stuck on old versions of the policy hence it is not being deleted. Is there any way to retroactively apply policies to old indexes. Also, is there any way to link indexes that are already created to a new index template? Thanks!